npm-user-validate

Release historycaution

The package has existed for about 13 years with 17 releases and two releases in the last 12 months. The long median interval of about 208 days indicates deliberate but modest release activity.

Repo bus factorcaution

All recent commits came from one contributor, creating a concentrated maintenance dependency; organization ownership provides some capacity to hand work off, but no second active contributor is shown.

Repo commit activitycaution

Only one commit was recorded in the last three months, showing limited recent maintenance activity.

Workflow auditcaution

All eight workflows were analyzed, but all 38 action references are unpinned and four workflows grant top-level write permissions. High-confidence template-injection findings and a medium-confidence bot-condition finding add workflow hygiene concerns, although no untrusted checkout or script-injection sink was detected.